The database password was in the repository, then in the image, then in an environment variable readable by anything that could run ps. Where it went next.
A threshold evaluated instantaneously fires on every transient spike, and transient spikes are constant — which is how a channel accumulates three hundred alerts a month. The for…